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Abstract. Using the proof-program (Curry-Howard) correspondence, we give a new 
method to obtain models of ZF and relative consistency results in set theory. We show the 
relative consistency of ZF + DC -I- there exists a sequence of subsets of R the cardinals 
of which are strictly decreasing + other similar properties of R. These results seem not to 
have been previously obtained by forcing. 



Introduction 

The technology of classical realizability was developed in [lb\ [TE\ in order to extend the 
proof-program correspondence (also known as Curry-Howard correspondence) from pure 
intuitionistic logic to the whole of mathematical proofs, with excluded middle, axioms 
of ZF, dependent choice, existence of a well ordering on P(N), . . . 

We show here that this technology is also a new method in order to build models of ZF and 
to obtain relative consistency results. 

The main tools are : 

• The notion of realizability algebra [18], which comes from combinatory logic [2] and plays a 
role similar to a set of forcing conditions. The extension from intuitionistic to classical logic 
was made possible by Griffin's discovery [7J of the relation between the law of Peirce and the 
instruction call-with-current-continuation of the programming language SCHEME. 
In this paper, we only use the simplest case of realizability algebra, which I call standard 
realizability algebra ; somewhat like the binary tree in the case of forcing. 

• The theory ZF^ |13) which is a conservative extension of ZF, with a notion of strong 
membership, denoted as e. 

The theory ZF^ is essentially ZF without the extensionality axiom. We note an analogy 
with the Fraenkel-Mostowski models with "urelements" : we obtain a non well orderable 
set, which is a Boolean algebra denoted 112, all elements of which (except 1) are empty. But 
we also notice two important differences : 
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• The final model of ZF + -■ AC is obtained directly, without taking a suitable submodel. 

• There exists an injection from the "pathological set" 112 into M, and therefore M is also 
not well orderable. 

We show the consistency, relatively to the consistency of ZF, of the theory ZF + DC 
(dependent choice) with the following properties : 

there exists a sequence {Xn)neN of infinite subsets of M, the "cardinals" of which are 
strictly increasing (this means that there is an injection but no surjection from Xn to Xn+i), 
and such that X^ x Xn is equipotent with Xmn for m,n >2 ; 

there exists a sequence of infinite subsets of M, the "cardinals" of which are strictly 
decreasing. 

More detailed properties of M in this model are given in theorems 15.51 and I5.9i 
As far as I know, these consistency results are new, and it seems they cannot be obtained 
by forcing. But, in any case, the fact that the simplest non trivial realizability model 
(which I call the model of threads) has a real line with such unusual properties, is of interest 
in itself. Another aspect of these results, which is interesting from the point of view of 
computer science, is the following : in [18], we introduce read and write instructions in a 
global memory, in order to realize a weak form of the axiom of choice (well ordering of M) . 
Therefore, what we show here, is that these instructions are indispensable : without them, 
we can build a realizability model in which M is not well ordered. 

1. Standard realizability algebras 

The structure of realizability algebra, and the particular case of standard realizability algebra 

are defined in [18]. They are variants of the usual notion of combinatory algebra. Here, we 

only need the standard realizability algebras, the definition of which we recall below : 

We have a countable set Hq which is the set of stack constants. 

We define recursively two sets : A (the set of terms) and 11 (the set of stacks). Terms and 

stacks are finite sequences of elements of the set : 

UoU{B,C,E,I,K,W,CC,<i,k,i,),U-} 
which are obtained by the following rules : 

• B, C, E, I, K, W, CC, ? are terms {elementary combinators) ; 

• each element of Hq is a stack {empty stacks) ; 

• if ^, ?y are terms, then (^)r/ is a term (this operation is called application) ; 

• if ^ is a term and vr a stack, then ^ . vr is a stack (this operation is called push) ; 

• if vr is a stack, then k[7r] is a term. 

A term of the form k[7r] is called a continuation. From now on, it will be denoted as k^. 
A term which does not contain any continuation (i.e. in which the symbol k does not 
appear) is called proof-like. 

Every stack has the form vr = ^i Cn • ttq, where ^i, . . . , i^„ G A and ttq € Hq, i.e. ttq is 

a stack constant. 

If ^ G A and vr G H, the ordered pair (^, vr) is called a process and denoted as ^ * vr ; 
^ and vr are called respectively the head and the stack of the process ^ * vr. 
The set of processes A x n will also be written A * IT. 
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Notation. 

For sake of brevity, the term (. . . (((C)?7i)r/2) • • ■)rin will be also denoted as (C)?7ir/2 ...??« or 

^r]ir]2 ■ ■ ■ rjn, if the meaning is clear. For example : ^r/C = {S,)ri( = (^r/)(" = {{6.)rj)C. 

We now choose a recursive bijection from A onto N, which is written ^ i — t- n^. 

We put a = {BW){B)B (the characteristic property of a is given below). 

For each n € N, we define n G A recursively, by putting : = KI ; n + 1 = {cr)n ; 

n is the n-th integer and a is the successor in combinatory logic. 

We define a preorder relation >- on A * H. It is the least reflexive and transitive relation 

such that, for all ^, ry, C G A and 7r,w £ll, we have : 

(^)r/*7r y $,-kr] .TT. 

I -k^ .TT y ^-kTT. 

K -k^ .rj .TT >- ^•vr. 
E -k^ .rj .IT y iOv*'^- 
W -k^ .rj .IT >- ^-krj .rj .IT. 

C'k^.rj.C,.TT>-£^'kC,.rj.TT. 

B-kC'V-C-T^>- (0(^)C*vr. 

CC-k^.TTy^-kkT^.TT. 

kj^ -k^ .w y ^*7r. 

q-k ^ .rj .IT >- ^-k^j^.TT. 

For instance, with the definition of and a given above, we have : 

0-k^.r].TTyr]-k7T; a * ^ .r] . ( .tt y {$.v){v)C *^- 

Finally, we have a subset X of A*n which is a final segment for this preorder, which means 

that: ■^•vrGX, .^ ' * vr' >- ^ • vr =^ £,' *tt' £ ±. 

In other words, we ask that X has the following properties : 

(^)ry -kTT^±^£,-kr].TT^±. 

/•^.vr^ X^^*7r ^ X. 

K-kS,.ri.-iT^±^S,*-iT^±. 

Eir^ .ri .7T ^ ± ^ {S,)ri • vr ^ X. 

W^^.rj.TT^JL^^-krj.rj.TT^JL. 

C-kS,.r].C.TT<^±^S.*C-V-'^^-^- 
Bi<^.r].C.TT^±^ {Oir])C*TT^±. 
CC*.^.7r^X^^*k7r.vr^X. 

kT,'k^.'CU^±^S,*7T^±. 
(^-k^.rj.TT^jL^^-knrf.TT^JL. 

Remark. Thus, the only arbitrary elements in a standard realizability algebra are the set Hq of 
stack constants and the set X of processes. 

C-terms and A-terms. 

We call C-term a term which is built with variables, the elementary combinators B, C, E, 
I, K, W, CC, ? and the application (binary function). A closed C-term is exactly what we 
have called a proof-like term. 

Given a C-term t and a variable x, we define inductively on t, a new C-term denoted by \x t, 
which does not contain x. To this aim, we apply the first possible case in the following list : 

1. Xxt = {K)t if t does not contain x. 

2. Xxx = I. 
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3. Xxtu = {C\x{E)t)u if u does not contain x. 

4. Xxtx = {E)t if t does not contain x. 

5. Xxtx = {W)Xx{E)t (if t contains x). 

6. Xx{t){u)v = Xx{B)tuv (if Mf contains x). 

In [18], it is shown that this definition is correct. This allows us to translate every A-terni 
into a C-term. In the following, almost every C-term will be written as a A-terni. The 
fundamental property of this translation is given by theorem II. !( which is proved in [TS] : 

Theorem 1.1. Let t be a C-term with the only variables xi,...,Xn ; let S,i,...,S,n S A 
and vr € n. Then Xxi . . . Xxn t-k^i ^n • "^ >- t[S,i/xi, . . . ,£,n/xn] * vr. 

Remark. The property we need for the terra a (the successor) is a -k ^ , rj , (^ . t: "^ (^'7)(^)C * "^ 
(to prove theorem 14. 12p . Therefore, by theorem ll.il we could define a = XnXJ Xx{nf){f)x. The 
definition we chose is much simpler. 

2. The formal system 

We write formulas and proofs in the language of first order logic. This formal language 
consists of : 

• individual variables x,y, . . . ; 

• function symbols f,g,... ; each one has an arity, which is an integer ; function symbols 
of arity are called constant symbols. 

• relation symbols ; each one has an arity ; relation symbols of arity are called propositional 
constants. We have two particular propositional constants T, _L and three particular binary 
relation symbols ^ ,^,Q. 

The terms are built in the usual way with individual variables and function symbols. 

Remark. We use the word "term" with two different meanings : here as a term in a first order 

language, and previously as an element of the set A of a realizability algebra. I think that, with the 

help of the context, no confusion is possible. 

The atomic formulas are the expressions R{ti, . . . , t„), where R is a n-ary relation symbol, 

and ti, . . . ,tn are terms. 

Formulas are built as usual, from atomic formulas, with the only logical symbols ^•,V : 

• each atomic formula is a formula ; 

• ii A,B are formulas, then ^ — t- i? is a formula ; 

• if ^4 is a formula and x an individual variable, then Vx A is a formula. 
Notations. 

The formula Ai -^ {A2 ->(••• {An -^ B)---)) will be written Ai,A2,...,An->B. 

The usual logical symbols are defined as follows : 

^A = A ^ ± ; Ay B = {A ^ ±),{B ^ ±) ^ ± ; A A B = {A,B ^ ±) ^ ± ] 

3xF = Vx(F^_L) ^_L. 

More generally, we shall write 3x{Fi, . . . , Fk} for Vx(Fi, . . . , F^ ^> _L) — > _L. 

We shall sometimes write F for a finite sequence of formulas Fi, . . . ,Fi. ; 

Then, we shah also write F ^ G for Fi,. . . ,Fk ^ G and 3x{F} for \/x{F — ;> _L) — )• _L. 

j4 o -B is the pair of formulas {A —^B,B^ A}. 

The rules of natural deduction are the following (the Ai^s are formulas, the x^'s are variables 

of C-term, t, u are C-terms, written as A-terms) : 
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i. Xi '. Ai, • • • J Xn • -An i Xi '. Ai. 

A, X\ . A.\ , . . . , X^ . -/i^ I h , l\ 7 JD ^ X\ , ^^1 5 • • • 5 -^Tl • -^Tt ' ^ * -^ 

^ xi : Ai,. . . ,Xn '■ An \- tu : B. 

3. xi : Ai, . . . ,Xn ■ An,x : Ah t : B => xi : Ai, . . . ,Xn '■ An \- Xxt : A ^- B. 

4. xi : Ai, . . . ,Xn '■ An \- t : A =^ xi : Ai, . . . , Xn '■ An \- t : ^/x A where x is an individual 
variable which does not appear in Ai , . . . , An ■ 

5. xi : Ai, . . . ,Xn '■ An \- t : VxA =^ xi : Ai, . . . ,Xn '■ An \- t : A[t/x] where x is an 
individual variable and r is a term. 

6. xi : Ai,...,Xn: An \-CC: {{A ^ B) ^ A) ^ A (law of Peirce). 

7. xi : Ai, . . . ,Xn '■ An \- t : ± =^ xi : Ai, . . . ,Xn '■ An \- t : A for every formula A. 

3. The theory ZF^ 

We write below a set of axioms for a theory called ZF^. Then : 

• We show that ZF^ is a conservative extension of ZF. 

• We define the realizability models and we show that each axiom of ZF^ is realized by a 
proof-like C-term, in every realizability model. 

It follows that the axioms of ZF are also realized by proof-like c-terms in every realizability 

model. 

We write the axioms of ZF^ with the three binary relation symbols ^ , ^ , C. Of course, xey 

and X G y are the formulas x^y ^^ 1. and x ^ y —?■ -L. 

The notation x ^ y ^ F means x Q y,y '^ x —^ F. Thus x ~ y, which represents the usual 

(extensional) equality of sets, is the pair of formulas {x Q y,y CI x}. 

We use the notations (yxea)F{x) for Vx(-iF(x) — > x^a) and 

(3xea)-F(x) for -iVx(F(x) —^ x^a). 

For instance, (3xey)t ~ u is the formula -iVx(t Cu,u'^t^x^y). 

The axioms of ZF^ are the following : 

0. Extensionality axioms. 

VxVy[x ^ y ■v^ (3zey)x ~ z] ; VxVy[x Q y -^ (Vzex)z G y]. 

1. Foundation scheme. 

Vxi...Vx„Va(Vx((Vyex)F[y,xi,...,x„] -^ F[x,xi, . . . ,x„]) -^ F[a,xi, . . . ,x„]) 
for every formula -F[x, xi, . . . , x„]. 

The intuitive meaning of axioms and 1 is that e is a well founded relation, and that the 
relation G is obtained by " collapsing " e into an extensional binary relation. 

The following axioms essentially express that the relation e satisfies the axioms of Zermelo- 
Fraenkel except extensionality. 

2. Comprehension scheme. 

Vxi . . . Vx„Va36Vx(xe6 o {xea A F[x,xi, . . . ,x„])) 
for every formula F[x, xi, . . . , x„]. 

3. Pairing axiom. 
\/ayb3x{a ex,bex}. 

4. Union axiom. 
Va36(Vx e a) (Vy ex)y eh. 

5. Power set axiom. 

y o^bM x{3y eh)y z{z ey o {zea f\ zex)). 
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6. Collection scheme. 

Vxi ...Vx„Va36(Vxea)(3yF[a;,y,xi,... ,x„] -> {3yeb)F[x,y,xi,. . . ,Xn]) 
for every formula F[x, y, xi, . . . , x„]. 

7. Infinity scheme. 

Vxi . . .yxnya3b{aeb,{\/xeb){3y F[x,y,xi, . . . ,x„] -^ {3y£b)F[x,y,xi,... ,x„])} 
for every formula F[x, y, xi, . . . , x„]. 

The usual Zermelo-Fraenkel set theory is obtained from ZF^ by identifying the predicate 
symbols ^ and ^. Thus, the axioms of ZF are written as follows, with the predicate symbols 
^, C (recall that x ~ y is the conjunction of x Q y and y Q x) : 

0. Equality and extensionality axioms. 

VxVy[x (z y -^ {3z G y)x ~ z] ; VxVy[x Q y -^ (Vz € x)z G y]. 

1. Foundation scheme. 

\/xi...Vx„Va(Vx((Vy E x)F[y, xi, . . . ,x„] -^ F[x,xi,... ,x„]) ^ F[a,xi,.. . ,x„]) 
for every formula F[x, xi, . . . , x„] written with the only relation symbols ^, C. 

2. Comprehension scheme. 

Va36Vx(x G 6 o (x G a A F[x, xi, . . . , x„])) 

for every formula F[x, xi, . . . , x„] written with the only relation symbols ^, C. 

3. Pairing axiom. 
\/ayb3x{a G x, 6 G x}. 

4. Union axiom. 
Va36(Vx G a)(Vy & x)y & b. 

5. Power set axiom. 

Va36Vx(3y G 6)Vz(z G y o (z G a A z G x)). 

6. Collection scheme. 

Vxi . . . Vx„Va36(Vx G a)(3y F[x,y,xi, . . . , x„] -^ {3y G 6)F[x,y,xi,. . . ,x„]) 

for every formula F[x, y, xi, . . . , x„] written with the only relation symbols ^, C. 

7. Infinity scheme. 

Vxi ...Vx„Vo36{a G 6, (Vx G 5)(3|/ F[x,y,xi, . . . ,x„] ^ (3y G 6)F[x, y, xi, . . . ,x„])} 
for every formula F[x, y,xi, . . . , x„] written with the only relation symbols ^, C. 

Remark. The usual statement of the axiom of infinity is the particular case of this scheme, where 
a is 0, and F{x, y) is the formula y ~ x U {x}. 

Let us show that ZF^ is a conservative extension of ZF. First, it is clear that, if ZFg h F, 
where F is a formula of ZF (i.e. written only with ^ and C), then ZF h F ; indeed, it is 
sufficient to replace ^ with ^ in any proof of ZFg h F. 
Conversely, we must show that each axiom of ZF is a consequence of ZFg. 

Theorem 3.1. 

i) ZFfr h ^a{a C a) (and thus a ~ a), 
ii) ZFir h \/a\/x{xea — > x G a). 

Proof. 

i) Using the foundation axiom, we assume \lx{x£a — > x C x), and we must show a C a ; 
therefore, we add the hypothesis xea. It follows that x C x, then x ~ x, and therefore : 
3y{x ~ y,yea}, that is to say x £ a. Thus, we have Vx(xea — > x G a), and therefore 
a C a. 
ii) Just shown. □ 
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Corollary 3.2. ZFe h \/x{x ea^xeb)-^aCb. 

Proof. We must show xea — > a; € 6, which fohows from x a a ^ x a b and xea ^ x (z a 
(theorem 13 -ir ii)). D 

Lemma 3.3. ZF^ h a C &, \/x{x ^b^x^c)^aQc. 

Proof. We must show x e a — )• x G c, which follows from x e a — )• x € 6 and xG6— )-x€c. □ 

Theorem 3.4. ZF^ h 'iy\/z{y c^ia, a£z^y£z) ; ZFg h \/y\/z{a <^ y, z e a ^ z £ y). 

Proof. Call -F(a), F'{a) these two formulas. We show F{a) by foundation : 

thus, we suppose (Vxea)F(x) and we first show F'{a) : by hypothesis, we have a C y, 

z G a ; thus, there exists a' such that z ^ a' and a' ea, and thus F{a'). From a'ea and 

a 'Z y, ^e deduce a' G y. From z c:^ a' and a' G y, we deduce 2; G y by F{a'). 

Then, we show F{a) : by hypothesis, we have y :^ a, a (^ z, thus a c:i y' and j/'ez for some 

y' . In order to show y G z, it is sufficient to show y c^ y' . 

Now, we have y c=: a, a c^ y' , and thus y' ^ a, a Q y. From F'{a), we get Vz(z G a — )• 2; G y) ; 

from y' C a, we deduce y' ^ y by lemma [3^ 

We have also y '■^ a, a C y' . From F'{a), we get Vz(2 & a ^ z & y') ; from y C a, we deduce 

y Q y' by lemma [331 □ 

With corollary I3.2[ we obtain : 

Corollary 3.5. ZF^ h 6 C c f^ Vx(x G 6 ^ x G c). D 

It is now easy to deduce the equality and extensionality axioms of ZF : 

Vx(x ~ x) ; VxVy(x ~ y — ?> y ~ x) ; VxVyVz(x ~y,y~2;^^x~2;) ; 
VxVx'VyVy'(x ~ x', y ~ y', x ^ y — )• x' ^ y') ; \/x\/y(\/z{z ^xoz^y)— )-x~y) ; 
VxVy(x C y o Vz(z ^ y ^ z ^ x)). 

Remark. This shows that ~ is an equivalence relation which is compatible with the relations G 

and C ; but, in general, it is not compatible with e. It is the equality relation for ZF ; it will be 

called extensional equivalence. 

Notation. The formula \lz{z^y -^ z^x) will be written x C y. The ordered pair of 

formulas x <Z y,y <Z x will be written x ~ y. 

By theorem 13. H we get ZF^ h VxVy(x C y ^- x Q y). Thus C will be called strong 

inclusion, and ~ will be called strong extensional equivalence. 

• Foundation scheme. 

Let F[x] be written with only ^, C and let G[x] be the formula yy{y ~ x — )• F[y]). Clearly , 
VxG[x] is equivalent to VxF[x]. Therefore, from axiom scheme 1 of ZF^, it is sufficient to 
show : V6(Vx(x G b -^ F[x]) -^ F[b]) -^ (Vx(xea -^ G[x]) -^ G[a]), i.e. : 
V6(Vx(x G 6 ^ F[x]) -^ F[b]),\lx\/y{xea,y^ x -^ F[y]),ac::^ b -^ F[b]. 
Therefore, it is sufficient to prove : VxVy(x e a, y ~ x — >■ F[y]),a ~ 6 ^ Vx(x G 6 — )• F[x]). 
From X G 6, a — 6, we deduce x G a and therefore (by axiom 0), x' e a for some x' ~ x. 
Finally, we get F[x] from \/x\/y{xea,y ~ x — > F[y\). 
• Comprehension scheme : Va36Vx(x G 60 (x G a f\ F[x\)) 
for every formula F[x, xi, . . . , x„] written with ^, C. 

From the axiom scheme 2 of ZFg, we get Vx(xe6 o (xea A F[x])). If x G 6, then x ~ x', 
x'eft for some x'. Thus x'ea and -F[x']. From x ~ x' and x' ea, we deduce x G a. Since C 
and G are compatible with ~, it is the same for F ; thus, we obtain F[x]. 
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Conversely, if we have F[x\ and x S a, we have x ~ x' and x' ea for some x' . Since F is 
compatible with ~, we get i*'[x'], thus x' eb and x € 6. 

• Pairing axiom : VxVy3z{x & z,y (^ z}. 

Trivial consequence of axiom 3 of ZF^, and theorem 13.1( 11). 

• Union axiom : Va36VxVy(x (za,y(^x^y(zb). 

From X € o we have x ~ x' and x' ea for some x' ; we have y € x, therefore y (z x' , thus 
y — y' and y' e x' for some y'. From axiom 4 of ZF^, x' ea and y' ex' , we get y' eb ; therefore 
y G 6, by y ~ y'. 

• Power set axiom : \/a3b\/x3y{y G b,yz{z €y-<r^{z€aAz€ x))} 

Given a, we obtain b by axiom 5 of ZF^ ; given x, we define x' by the condition : 
yz{zex' -H- {zea A z G x)) (comprehension scheme of ZF^). By definition of 6, there exists 
y eb such that \/z{zey -H- zea A zex'), and therefore \lz{zey ^ zea Az G x). 
It follows easily that '^z{z Gy-H-zGaAzGx). 

• Collection scheme : Va36(Vx G a)(3yF[x,y] ^^ (3y G 6)F[x,y]) 

for every formula -F[x, y, xi, . . . , x„] written with the only relation symbols ^, C. 
From X G a and 3yF[x,y], we get x ~ x', x'ea for some x', and thus 3yF[x',y] since F 
is compatible with ~. From axiom scheme 6 of ZF^, we get (3ye6)i^[x', y], and therefore 
(3y G 6)F[x,y], by theorem 13.1( 11). again because F is compatible with ~. 

• Infinity scheme : '^d3b{a G 6, (Vx G 6)(3yF[x,y] — > (3y G 6)F[x,y])} 

for every formula F[x, y, xi, . . . , Xn] written with the only relation symbols ^, C. 
Same proof. 



4. Realizability models of ZF 



£ 



As usual in relative consistency proofs, we start with a model M. of ZFC, called the ground 

model or the standard model. In particular, the integers of A4 are called the standard 

integers. 

The elements of A4 will be called individuals. 

In the sequel, the model M will be our universe, which means that every notion we consider 

is defined in M. In particular, the realizability algebra (A,n,i) is an individual of A4. 

We define a realizability model J\f, with the same set of individuals as Ai. But Af is not a 

model in the usual sense, because its truth values are subsets of 11 instead of being or 1. 

Therefore, although A4 and Af have the same domain (the quantifier Vx describes the same 

domain for both), the model Af may (and will, in all non trivial cases) have much more 

individuals than A4, because it has individuals which are not nam,ed. In particular, it will 

have non standard integers. 

Remark. This is a great difference between realizability and forcing models of ZF. In a forcing 

model, each individual is named in the ground model ; it follows that integers, and even ordinals, 

are not changed. 

For each closed formula F with parameters in A4, we define two truth values : 

||F|| C n and |F| C A. 

|-F| is defined immediately from ||i^|| as follows : 

^G |F| ^ (Vvr G |[F||)^*7rG X. 
Notation. We shall write C Ih-^ (read "^ realizes F ") for .^ G |F|. 
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||F|| is now defined by recurrence on the length of F : 

• F is atomic ; 

then F has one of the forms T, _L, a^6, a C 6, a ^ 6 where a, b are parameters in A4. 

We set : 

||T||=0; ||±||=n; |la^6|l = {7rGn; (a,7r) g6}. 

||o Q b\\, ||o ^ ^11 are defined simultaneously by induction on (rk(a)Urk(6),rk(a)nrk(6)) 
(rk(a) being the rank of a). 

||aC6||=|J{^.7r; ^ G A, vr G H, (c,7r) G a, ^ h c ^ b} ; 



C 

^ = A->B; then ||F|| = {^ . vr ; 
F^Vx^ithen ||F|| = (J p[a/a 



\\a 

c 

• F = A-> B ; then \\F\\ = {S, . n ; ^ \\- A, n e \\B\\}. 

• F = \/xA : then ||F|| = [J \\A\a/x 

a 

The following theorem is an essential tool : 



Theorem 4.1 (Adequacy lemma). 

Let Ai, . . . , An, A be closed formulas of ZF^, and suppose that xi : ^i, . . . , x„ : An \- t : A. 
If ii \^Ai,...,in hAi thent[ii/xi,...,in/xn] hA. 
In particular, if\-t:A, then t ||— A. 

We need to prove a (seemingly) more general result, that we state as a lemma : 

Lemma 4.2. Let Ai[z\,..., An[z\, A[z\ be formulas of ZF^, with z = (zi, . . . , z^) as free 

variables, and suppose that xi : Ai[z\, . . . ,Xn '■ An[z\ h t : A[z\. 

If ^1 ||— ^i[a], . . . ,^„ ||— ^„[a] for some parameters (i.e. individuals in M) 

a= {ai,... ,ak), then t[S,i/xi, . . . ,^n/xn] ||-^[«]- 

Proof. By recurrence on the length of the derivation of xi : Ai[z\, . . . ,Xn '■ An[z\ h t : A[z\. 
We consider the last used rule. 

1. xi : Ai[z\, . . . ,Xn '. An[z\ \- Xi : Ai[z\. This case is trivial. 

2. We have the hypotheses : 

xi: Ai[z\,... ,Xn: An[z\^ u: B[z\^ A[z\; xi : Ai[z\, . . . ,Xn : An[z\^ v : B[z\ ; t = uv. 
By the induction hypothesis, we have u[£,/x\ \[-B[a/z\ — > A[a/z\ and v[i/x\ \^B[d/z\. 
Therefore {uv)[^/x\ \^A[a/z\ which is the desired result. 

3. We have the hypotheses : 

xi:Ai[z\,...,Xn:An[z\,y:B[z\^u:C[z\; A[z\ = B[z\ ^ C[z\ ; t = \yu. 
We want to show that {\yu)\^/x\ \\- B[a/z\ -^ C[d/z\. Thus, let : 

rj \\-B[a/z\ and vr G ||C[a/z|||. We must show : 

(At/ n) [.^/x] • r/ . vr G X or else ti[.^/x, r^/y] •vr G X. 

Now, by the induction hypothesis, we have u[^/x,rj/y\ ||— (7[a/z|, 

which gives the result. 

4. We have the hypotheses : 

xi: Ai[z\,...,Xn: An[z\ h t : B[z\ ; A[z\ =VziB[z\ ; S.i \\- Ai[ai/ zi, 02/ Z2, ■ ■ ■ , ak/ z^] ; 

the variable zi is not free in Ai [z] , . . . , An [z\ . 

We have to show that t[^/x] \\-\/ziB[a/z\ i.e. t[S,/x] \\-\/ziB[a2/z2, ■ ■ ■ ,ak/zk]. Thus, we 
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take an arbitrary set b in A4 and we show t[^/x] ||— B[b/zi,a2/z2, . . . , ak/^k]- 

By the induction hypothesis, it is sufficient to show that S,i \\- Ai[b/zi, aij Z2^ ■ ■ ■ , a^/zk]- 

But this follows from the hypothesis on S,i, because zi is not free in the formulas Ai. 

5. We have the hypotheses : 

xi: Ai[z\,...,xn: Anight ■.\fyB[y,z\ ■,^A[z\ = B[T[z\/y, z\ ; Ci h Ma]- 

By the induction hypothesis, we have t[^/x] \\-yyB[y,a/z\ ; therefore t[^/x] \\- B[b/y,a/z\ 

for every parameter b. We get the desired result by taking b = T[a]. 

6. The result follows from the following : 

Theorem 4.3. For every formulas A,B, we have CC ||— {{A -^ B) ^ A) ^ A. 

Proof. Let ( \\- {A ^ B) ^ A and vr G \\A\\. Then CC*^.7r>-.^*k7r.7r which is in X, 
because k^ \\- A ^ B by lemma 14.41 □ 

Lemma 4.4. // vr € ||A||, then k.„ \\- A ^ B. 

Proof. Indeed, let ^ ||— ^ ; then k^^^.vr'^^ + vrGX for every stack vr' € ||-B||. D 

7. We have the hypothesis xi : Ai[z\, . . . ,Xn '■ An[z\ h t : _L. 

By the induction hypothesis, we have t[C/a^] Ih X. Since ||_L|| = H, we have t[^/x\ * vr G X 

for every vr € ||^[a/z|||, and therefore i[C/af] ||— ^[a/z] which is the desired result. 

This completes the proof of lemma 14.21 and theorem 14.11 □ 

Realized formulas and coherent models. In the ground model 7W, we interpret the formulas 

of the language of ZF : this language consists of ^, C ; we add some function symbols, but 

these functions are always defined, in A^, by some formulas written with ^, C. We suppose 

that this ground model satisfies ZFC. 

The value, in A^, of a closed formula F of the language of ZF, with parameters in 7V4, is of 

course 1 or 0. In the first case, we say that A4 satisfies F, and we write A4 \= F. 

In the realizability model TV, we interpret the formulas of the language of ZF^, which 

consists of ^ ,^,Q and the same function symbols as in the language of ZF. The domain of 

Af and the interpretation of the function symbols are the same as for the model Ai. 

The value, in TV, of a closed formula F of ZF^ with parameters (in Ai or in TV, which is 

the same thing) is an element of "/-"(H) which is denoted as ||-F|j, the definition of which has 

been given above. 

Thus, we can no longer say that TV satisfies (or not) a given closed formula F. But we shall 

say that TV realizes F (and we shall write TV ||— -F), if there exists a proof-like term 6 such 

that 9 ||— F. We say that two closed formulas F, G are interchangeable if TV [[— F o G. 

Notice that, if \\F\\ = ||G|[, then F,G are interchangeable (indeed / Ih -^ ~^ ^); but the 

converse is far from being true. 

The model TV allows us to make relative consistency proofs, since it is clear, from the 

adequacy lemma (theorem 14. ip , that the class of formulas which are realized in TV is closed 

by deduction in classical logic. Nevertheless, we must check that the realizability model TV 

is coherent, i.e. that it does not realize the formula _L. We can express this condition in the 

following form : 

For every proof-like term 9, there exists a stack vr S 11 such that 9 -kn ^ JL. 

When the model TV is coherent, it is not complete, except in trivial cases. This means that 
there exist closed formulas F of ZFg such that J\f \j/- F and TV \j/- ^F. 
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The axioms of ZF^ are realized in M. 

• Extensionality axioms. 

We have ||V2;(2; ^b ^ -2^a)|| = !){■? • tt; ^ \\- c ^ b, tt e \\c^a\\} 

c 

by definition of the value of ||Vz(z ^ b ^ z ^ a)\\ ; 

and \\a C 6|| = M{^ . vr; (c, vr) G a, S, \\- c ^ b} by definition of \\a C b\\. 

c 

Therefore, we have \\a Q b\\ = ||Vz(z ^ 6 — > z^a)||, so that : 

/ ||-VxVy(x C y -^\lz{z ^ y ^ z^x)) and / \\^\/x\ly(\/z{z ^ y — )• 2:^x) ^- x C y). 

In the same way, we have : 

|lVz(a C z,z C a^ zfb)\\ = |JU . C' • vr; ^ ||- a ^ c, ^' ||- c C a; vr G ||c^6|l} 

c 

by definition of the value of ||V2;(a C z, z C a — )• z^6)|| ; 

and ||a ^ 6|| = M{^ ..^' .vr; (c, vr) G 6, ^ l^a C c, ^' ||-c C a}} by definition of ||a ^ 6||. 

c 

Therefore, we have \\a ^ 6|| = ||Vz(a C z,z C a ^ z^6)||, so that : 
/ ||- \/xiy{x ^ y — )• \lz{x ^ z,z '^ x ^ z^y)) ; 
/ 1^ VxVy(V2;(x ^ z,z (^ x ^ z^y) ^ x ^ y). 

Notation. We shall write ^ for a finite sequence (^i, . . . ,.^„) of terms. Therefore, we shall 

write C ||- j4 for ^j ||— ^j (^ = li • • • i n). 

In particular, the notation ^ [[— a ~ 6 means .^i |h a ^ 6, ^2 Ih ^ — ^ i 

the notation ^ ||- ^4 o i? means .^i ||- ^4 ^^ B, ^2 Ih -^ ^^ ^• 

• Foundation scheme. 

Theorem 4.5. For every finite sequence F[x,xi, . . . ,Xn] of formulas, we have : 

Y lhVx(Vy(F[y] ^y^x),F[x\ -^ 1.) ^ Vx(F[x] ^ ±) 

with Y = j4y4 and A = \a\f{f){a)af (Turing fixed point conibinator) . 

Proof. Let S, ||— Va;(Vy(F[y] — )• y^a;),F[x] — )• _L). We show, by induction on the rank of a, 

that : 

Y*^ . ff. vr G X, for every vr G 11 and f/||— F[a]. 

Since Y -kS, -ff -tt >- ^*Y,^.r/.vr, it suffices to show ^ * Y^ • r/ • vr G JL. 

Now, ^ ||-Vy(F[y] ^^ y^a),F[a\ -^ ±, so that it suffices to show Y^ ||-Vy(F[y] -^ y^a), 

in other words Y^ Ih -^M ~^ ^^o, for every b. Let C ||— -F[6] and w G ||6^a||. Thus, we 

have {b,w) G a, therefore rk(6) < rk(a) so that Y -k ^ . ^ .w £ A. by induction hypothesis. 

It follows that Y^-k ( .w G i, which is the desired result. □ 

It follows from theorem 14.51 that the axiom scheme 1 of ZFg (foundation) is realized. 

• Comprehension scheme. 

Let a be a set, and F[x] a formula with parameters. We put : 

6 = {(x,^ . vr); (x, vr) G a, ^ ||— F[x]} ; then, we have trivially |[x^6|| = |Ii^(x) -^ x^a\\. 
Therefore / ||—Vx(x^ 6 ^^ (F(x) —T' x^ a)) and / ||— Vx((F(x) — )■ x^a) ^^ x^6). 

• Pairing axiom. 

We consider two sets a and 6, and we put c = {a,b}xll. We have ||a^c|| = ||6^c|| = ||-L||, 
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thus / ||- a e c and / \\- bee. 

Remark. 

Except in trivial cases, c has many other elements than a and b, which have no name in Ai. 

• Union axiom. 

Given a set a, let b = Cl(a) (the transitive closure of a, i.e. the least transitive set which 

contains a). We show \\y^b ^ x^a\\ C \\y^x ^ x^a\\ : 

indeed, let ^ . vr G |||/^6 —> x^a||, i.e. S,\\~y^b and (x,7r)ea. 

Therefore, x C Cl(a), i.e. x Qb and thus ||y^fo|| D ||y^z||. 

Thus, we have ^ \\-y^x, which gives the result. 

It follows that / ||— VxVy((y^x -^ x^a) — ?> {y^b^>- x^a)). 

• Power set axiom. 

Given a set a, let b = V{C\{a) xll) xll. For every set x, we put : 

y = {(z,,^.7r); ^ \\-zex, (z,7r) G a}. We have y = {(z,^.7r); ^ j|-zex, tt G ||z^a|[}, and 

therefore lU^-ull = \\zex ^ zia\\. Thus : 

I \\-\/z{z^y ^ {zex ^ z^a)) and I \[-\/z{{zex ^ z^a) ^ z^y). 

Now, it is obvious that y G 7^(Cl(a) xII), and therefore (y, vr) G 6 for every vr G 11. 

Thus, we have ||y^6|| = IT = ||-L||. It follows that : 

\f{f)II \\^\/x(yy(yz{z^y -^ {zex -^ z ^ a)) ,\/ z{{z e x -^ z^a) ^ z^y) -^ y^b) -^ ±). 

• Collection scheme. 

Given a set a, and a formula F[x,y] with parameters, let : 

6 = (J{$(x,^)xCl(a); xGCl(a),Ce A} with 

<&(x, ^) = {y of minimum rank ; ^ ||— -F[x, y]} or <l>(a;, .^) = if there is no such y. 
We show that \\\/y{F[x,y] ^x^a)\\ C \\\/y{F[x,y] ^yif:b)\\ : 

Suppose indeed that ^ . tt G ||V|/(F[x,y] -^ x^a)\\, i.e. {x,tt) G a and ^ ||— F[x,y] for 
some y. By definition of $(x,^), there exists y' G <5(x,^). Moreover, we have : 
X G Cl(a), IT G Cl(a), and therefore (y',7r) G 6 ; it follows that vr G ||y'^6||. But, since 
y' G <^(x,^), we have ^ ||— F[x, y'] and thus ^ . vr G j|F[x,y'] — )■ yV^II) which gives the 
result. We have proved that / \\-\/x{yy{F[x,y] -^ y^b) — > Vy(F[x,y] -^ x^a)). 

• Infinity scheme. 

Given a set a, we define b as the least set such that : 

{a}xnc& and Vx(V7r G n)(V^ G A)((x,7r) G 6 ^ ^(x,^ x {vr} C 6) 
where <&(x,^) is defined as above. 

We have {ajxll C 6, thus ||a^6|| = ||-L||, and therefore / ||— ae6. 
We now show that \\\/y{F[x,y] — > x^6)|| C \\\/y{F[x,y\ — > y^6)|| : 

Suppose indeed that .^ . vr G \\\/y{F[x,y] — )> x^6)||, i.e. (x,vr) G b and ^ ||-F[x,y] for 
some y. By definition of <I>(x,^), there exists y' G <I>(x,^). By definition of 6, we have 
(y',vr) G 6, i.e. vr G ||y'^6||. Now, since y' G $(x,^), we have .^ ||-F[x,y'] and thus : 
^ . vr G ||F[x,y'] -^ y' ^b\\, which gives the result. 
We have proved that / ||— ae6 and / ||— Vx(Vy(F[x,y] -^y^b) — > Vy(F[x,y] -^ x^b)). 
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Function symbols and equality. 

According to our needs, we shall add to the language of ZF^, some function symbols f,g,... 

of any arity. A k-ary function symbol / will be interpreted, in the realizability model J\f, by 

a functional relation, which is defined in the ground model A^ by a formula F[xi, . . . ,Xk,y] 

of ZF. Thus, we assume that M. \= Vxi . . . Vx^Bly F[xi, . . . , Xk,y] 

{3\y F[y] is the conjunction of \/y'^y'{F[y], F[y'] ^ y = y') and 3yF[y]). 

The axiom schemes of ZF^, written in the extended language, are still realized in the model 

J\f, because the above proofs remain valid. 

On the other hand, in order to make sure that the axiom schemes of ZF, which use a k-ary 

function symbol /, are still realized, one must check that this symbol is compatible with ~, 

i.e. that the following formula is realized in Af : 

Vxi . . . yxk{xi ~ yi, . . . , Xfc ~ 2/fc ^ /a^i • • • a:fc ~ /yi . . . yk)- 

We now add a new rule to build formulas of ZF^ : 

li t,u are two terms and F is a formula of ZFg, then t = u ^-^ F is a formula of ZF^. 

The formula t = u ^^ 1. is denoted t ^ u. 

The formula t ^ u ^- -L, i.e. (t = n ^-7> _L) — > _L is denoted t = u. 

The truth value of these new formulas is defined as follows, assuming that t,u,F are 

closed, with parameters in Af : 

|jt = n-^F|| = ift/n; ||t = n -^ F|| = |IF|I iH = u. 

It follows that : 

||t /n|| = = ||T|| ift^u;\\t^u\\=U=\\±\\ iit = u ; 

\\t = u\\ = |[T ^^ -L|| if t / u ; ||t = n|| = ||_L — > ±11 if t = u. 

Proposition 14.61 shows that t = u ^^ F and t = u ^ F are interchangeable. 

Proposition 4.6. 

i) \x{x)I \^{t = u^ F) ^ {t = u ^ F) ; 
a) \xXy{cc)\k{y){k)x ||- (t = u ^^ F),t = u^ F. 

Proof. 

i) Let S, \\- t = u ^ F and vr € \\t = u ^^ F\\. Thus, we have t = u and vr € ||-F||. 
We must show Xx{x)I • ^ . tt € X, that is .^ • / . vr € X. This is immediate, by hypothesis 
on ^, since I \\-t = u. 

ii) Let ^||— ^ = 1^^-^, rj \\- t = u and vr G \\F\\. We must show that : 
XxXy{cc)Xk{y){k)x • ^ . r? . vr G X, soit rj • k^r^ . tt G X. 
If t 7^ n, then rj [[— T ^ _L, hence the result. 
If t = n, then ^ ||— F, thus ^ * vr G X, therefore k^r^ ||— X. 
But we have r/ ||— X ^ X, and therefore rj -k k^^ . vr G X. □ 

Proposition 14.71 shows that the formulas t = u and \lx[u^x -^ t^x) (Leibniz equality) 
are interchangeable. 

Proposition 4.7. 

i) I [|— t = u ^^ \lx{u^x -^ t^x) ; 
ii) I \\^\lx{u^x — 7> t^x) -^ t = u. 

Proof. 

i) It suffices to check that / ||— Vx(n^2; — )• t^x) when t = u, which is obvious, 
ii) We must show that / ||— Vx(u^x -^ t^x),t ^ u ^ -L. Thus let ^ ||— Vx(ti^x — )• t^x), 
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rj \\-t ^ u and vr G 11 ; we must show that ^ • 77 . vr € X. 

We have S, \\—u^a — )■ t^a for every a ; we take a = {t} x H, thus ||i^a|| = H, hence 

TT E ||i^a||- 

If t = n, we have r/ jj— _L, thus t] \\-u^a, hence the result. 

If t 7^ n, we have ||u^a|| = = ||T||, thus t] \\-u^a, hence the result. D 

We now show that the axioms of equality are realized. 

Proposition 4.8. / ||— V3;(x = x) ; I ||— VxVy(x = y ^-> y = x) ; 

I \\-\/x\/yyz{x = y ^^ {y = z ^^ x = z)) ; 

I ||— VxVy(2; = 7/^-7- {F[x] — ?• i^[y])) for every formula F with one free variable, with 

parameters. 

Proof. Trivial, by definition of ^->. □ 

Conservation of well-foundedness. Theorem 14.91 savs that every well founded relation in the 
ground model A4 , gives a well founded relation in the realizability model M. 

Theorem 4.9. Let f be a binary function such that f{x,y) = 1 is a well founded relation 
in the ground model M. Then, for every formula F[x] of ZF^ with parameters in Ai : 
Y \^yx{yy{f{y,x) = 1 ^ F[y]) -^ F[x]) -^ \/x F[x] 
with Y = AA and A = XaXf{f){a)af. 

Proof. Let us fix a and let ^ ||— Vx(Vy(/(y,x) = 1 "^^^ F[y]) -^ F[x]). We show, by 

induction on a, following the well founded relation f{x,y) = 1, that Y*^ • vr E X for every 

vr G ||F[a]||. 

Thus, suppose that vr G ||-^[a]|| ; since Y-k^.ir >- ^ • Y^ . tt, we need to show that 

^* Y^ . TT E X. By hypothesis, we have ^ \\-yy{f{y,a) = 1 ^-> F[y]) — )• F[a]. 

Thus, it suffices to show that Y^ ||— f{y,a) = 1 "^^^ F[y] for every y. 

This is clear if /(y,a) / 1, by definition of ^->. 

If f{y,a) = 1, we must show Y^ ||— F[y], i.e. Y*,^ . p € X for every p E ||F[y]||. But this 

follows from the induction hypothesis. □ 

Sets in M give type-like sets in J\f. 

We define a unary function symbol 2 by putting 11(a) = a x 11 for every individual a 

(element of the ground model A4). 

For each set E of the ground model Ai, we also introduce the unary function 1e with values 

in {0, 1}, defined as follows : 

lE{a) = lifa(£E; lij(a) =Oiia^E. 

The formula Is (2;) = 1 ^^ A will also be denoted as xelE "^ A. 

In particular, a^lE is identical with aelE ^^ X that is l_B(a) 7^ 1. 

We shall write yx^^A[x] for yx{xe'JiE ^^ A[x]). 

Proposition 14.61 shows that xelE ^^ A and xelE ^ A are interchangeable. 

Therefore Vx j4[3;] and \/x{x£lE — )• A[x\) are also interchangeable. We have : 

||Vx^^^[x]|| = y \\A[a/x\\\ and |Vx^-^^[2;]| = [^ \A[a/x\\. 

a&E aeE 
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As already said, we shall add to the language of ZFg, some function symbols of any arity, 
which will be interpreted in the ground model Ai by some functional relations. Then every 
formula of the form Vx(ti[x] = ui[x], . . . ,tk[x] = Uk[x] -^ t[x] = u[x]) which is satisfied in 
the model A4, is realized in the model Af (ti, ui, . . . , t^^Uk-, t, u are terms of the language). 
Indeed, we verify immediately that : 

/ \\- Vx(ti[x] =ui[x] --^ (. . . --^ {tk[x] = Uk[x] -^ t[x] = u[x])) . . .). 

It follows that if, for instance, t[xo,xi] sends EqxEi into D in the model Ai, then it sends 
"JEq x^Ei into ^D in the model A/". Indeed, we have then : 

Ai 1= '\/xo\/xi{Iei-,{xo) = 1, 1e-i{xi) = 1 ^ l£i{t[xo,xi]) = 1) and therefore, we have : 
/ ||- VxoVxi(l£;(,(a;o) = 1 "-^ {1ei{xi) = 1 ^-s- l£){t[xo,xi]) = 1)), in other words : 
/ tyxf"yxl^'{t[xo,xi]£2D). 

Notice, in particular, that the characteristic function 1e, which takes its values in the set 
2 = {0, 1} in the model A^, sends 2E into 112 in the realizability model A/". 
We shall denote a, v,^ the (trivial) Boolean algebra operations in {0, 1} (they should not 
be confused with the logical connectives A, V, -■). In this way, we have defined three function 
symbols of the language of ZF^ ; thus, in the realizability model A^, they define a Boolean 
algebra structure on the set 112. 
Remarks. 

i) A set of the form 3-E behaves somewhat like a type, in the sense of computer science, because 
any function of the model At with domain (resp. range) Ei x ■ ■ ■ x Ek becomes a function of the 
model A/" with domain (resp. range) lEi x • • • xlEk- 

ii) The Boolean algebra 22 is, in general, non trivial i.e. it has e-elements 7^ 0, 1. Notice that they 
are all empty : indeed, it is easy to check that / ||— Vx Vy(a; 7^ 1 -^ y^x). 

The set N of integers in J\f. 

We add to the language of ZF^ a constant symbol and a unary function symbol s. Their 

interpretation in the model A4 is as follows : 

is ; s(a) is {ajxll for every set a, in other words s(a) = 2{{a}). 

In the realizability model AA, s{a) is the singleton of a. Indeed, we have trivially : 

||&^s(a)|| = \\h 7^ a\\ (i.e. if a 7^ 6 and II if a = 6) and it follows that : 

/ ||- \lx\/y{y^ sx -^ X ^ y) \ 1 ||- VxVy(a; i^ y ^ y^sx). 

For each n G N, the term s"0 will also be written n. 

Remark. In the definition of the set of integers in the realizability model AA, we prefer to use 

the singleton as the successor function s, instead of the usual one x \ — ;■ x U {a;}, which is more 

complicated to define. It would give : s(a) = {(a, X. tt); tt e 11} U {(x, . tt); (a;, tt) G a}. 

Theorem 4.10. The following formulas are realized in Af : 

i) VxVy(sx = sy '-^ x = y) ; 

ii) Vx(sx 9^ 0) ; 
iii) VxVy(x :^ y ^ sx ^ sy) ; 
iv) VxVy(sx ~ sy — 7- X ~ y). 

This shows, in particular, that the function s is compatible with the extensional equiva- 
lence ~. 
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Proof. 
i) We check that I \\- sa = sb ^^ a = b. We may suppose sa = sb, because 
\\sa = s6 ^-)- a = 6|| = if sa ^ sb. But, in this case, we have a = 6, by definition of sa, sb. 

ii) We have ||o ^ 0|| = ||Vx(j; ~ a — )• j;^0)|| =0, since ||x^0|| = 0. Now ||a^sa|| = 11 and 
therefore we have, for any ^ € A, Ax(x)^ ||— (a ^ ^ a^ sa) -^ _L ; thus : 
Xx{x)^ ||— Vx(2; ^0—7' x^sa) — > ±. But this means exactly that \x{x)^ ||— sa C —> ±, 
and therefore \x\y{x)^ ||- sa ~ —^ _L. 

iii) We show that the formula a ~ 6 ^- sa ~ s6 is realized ; it suffices to realize the formula 
a ~ 5 ^- sa C s6. We prove it by means of already realized sentences. 

We need to prove a~6, x^sb— t-x^ sa. But x^ sa has the same truth value as x ^ a. 
Thus, we simply have to prove a c^b ^f a ^ sb. But a & sb follows from be sb and a ':^b. 

iv) In the same way, we prove the formula sa ':^ sb ^ a ':^ b and, in fact sa (^ sb ^ a ^b. 
The formula sa C sb is Vx(x ^ sb ^ x^sa) ; but x^sa is the same as x / a. Thus, 
from sa C sb we obtain a € s6, i.e. (3xes6)x ~ a. But xesb is the same as x = 6, so 
that we obtain a c^^b. □ 

The individuals s^O are obviously distinct, for n £ N. Therefore, we can define : 

N={(s"0,n.7r); n G N, vr G B} 
and we have : 

||a^N|| = if a is not of the form s"0, with n G N ; 
||s"O^N|| = {n.7r; vr G H}. 
The formula x e N will also be written ent(x). 

In the sequel, we shall use the restricted quantifier Vx , which we also write Vx , with 
the following meaning : 

||Vx«n*F[x]|| = ||Vx^F[x]|| = {n.vr; n G N, vr G ||F[s"0]||}. 
The restricted existential quantifier 3x or 3x is defined as : 
3x^'itF[x] = 3x^F[x] = ^Vxe^*^F[x]. 

Proposition 14.111 shows that these quantifiers have indeed the intended meaning : the for- 
mulas Vx'''-'*F[x] and Vx(xeN ^ -F[x]) are interchangeable. 

Proposition 4.11. 

i) \x\yXz{y){x)z |hVx^"*F[x] ^ Vx(^F[x] ^x^N) ; 
ii) XxXy{cc)Xk{x)ky |hVx(^F[x] ^ x^N) ^ Vx^'^^Ffx]. 

Proof. 

i) Let ^ ||— Vx®'^* -F[x], rj \\--'F[a] and zu G ||a^N||. Thus, we have a = s"0 for some 
n G N (else ||a^N|| = 0) and tu = n . vr. We must show that r/^^n.vrGX. 
Now, by hypothesis on ^, we have (^-kn.p^A. for any p G ||F[s"'0]|l ; thus ^n |^F[s"0]. 
Since rj ||— -iF[s"0], we have r/*,^n . vr G X, which is the desired result. 

ii) Let ^ \\-yx{^F[x] ^ x^N) and n.vr G ||Vx™* F[x]||, with n G N and vr G ||i^[s''0]||. 
We have : XxXy{cc)Xk{x)ky -k ^ . n.n >~ ^-kk-jr .n.ir. 

Now, we have k,r Ih "'-^[^"O] and n . vr G ||s"O^N||. Therefore ^* k^r . n . vr G X. D 

Theorem 4.12 (Recurrence scheme). For every formula F[x,y] : 

i) / |hVxVn^(Vy(F[x,sy] ^ F[x, y]), F[x,n] ^F[x,0]). 
ii) I |hVxVn^(Vy(F[x,y] ^ F[x, sy]),F[x,0] ^ F[x,n]). 
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Proof. 

i) Let n € N, a a sequence of individuals, ^ [[- Vy(F[a, sy] — > F[a,y]), vr € ||F[a,0]||. 
We must show that, for every a \\- F[a, n] , we have I -kn. ^ . a .tt G i. 
In fact, we show, by recurrence on n, that n * ^ . a . vr € X. 

This is immediate if n = 0. In order to go from n to n + 1, we suppose now a \\- F[a, sn] ; 
we have n + 1 -kS^ .a .tt >- an -k^ .a .it y a -kn. S, • (x .tt y n-k^ . ^a .it. 
But, by hypothesis on ^, we have ^ ||— F[a, sn] — )■ F[a,n] ; thus S^a \\- F[d,n]. 
Hence the result, by the recurrence hypothesis. 

ii) Let n G N, a a sequence of individuals, ^ \\-\/y{F[d,y] -^ F[a,sy]), a \\- F[a,0] and 
vr € ||F[a, 0] II . We must show that /*n.^.a.7r€X; this follows from lemma 14.131 with 

k = o. n 

Lemma 4.13. Letn,k G N, ^ |hVy(F[y] -^ F[sy]), a Ih^l^'^O] and vr G HFls'^nJU. 
Then n • ^ . a . vr G X . 

Proof. The proof is done for all integers k, by recurrence on n. This is immediate if n = 0. 

In order to go from 71 to n+ 1, we suppose now vr G ||-F[s (n+ 1)]||, i.e. vr G ||-F[s '''"^n]||. 

We have re + 1 • ^ . q • vr >- an -k ^ . a .tt >~ a -kn.^ .a .tt >~ nk ^ .^a .it. 

But, by hypothesis on ^, we have ^ \r F[s^Q] -^ F[s''+^iS\ ; thus ^a \r F[s''+^Q]. 

Hence the result, by the recurrence hypothesis. □ 

Definition. We denote by int(re) the formula Vx(Vy(,sy/x — )• y/x),re^x — >■ O^x). 
Theorem l4. 151 shows that the formulas int(n) and reeN are interchangeable, i.e. the formula 
Vn(int(re) -f-)- reeN) is realized by a proof-like term : this is the storage theorem for integers. 

Lemma 4.14. \g\x{g){a)x ||- Vi/(sy^N — )• y/N). 

Proof. We show that \g\x{g){a)x ||— s6^N — )• 6^N for every individual b. 

This is obvious if b is not of the form s"0, since then ||6^N|| = 0. Thus, it remains to 

show : _ _ _ 

\gXx{g){a)x Ihs^+^O^N -^ s"O^N. Thus, let ^ Ih^^+^O^N ; we must show : 

\g\x{g){a)x * ^ . re . vr G X, i.e. ^ * an . vr G X, which is clear, since an = re + 1 . □ 

Theorem 4.15 (Storage theorem), 
i) / IhVx^ int{x). 
ii) T \r\ix{int{x),x^n -^ X) with T = XnXf{{n)XgXx{g){a)x)fO. 

Proof. 
i) It is theorem 14.12( 1). if we take for F[x,y] the formula y^x. 

ii) Let I' ||— int(a), (p ||— a^N and vr G H. We must show T -kv . (j) .tt G X, that is : 

V k XgXx{g){a)x . (/> . . vr G X. 

By hypothesis, we have v ||- Vy(sy^N ^ y^N),a^N -> O^N. 

But we have 0.vrG||O^N|| by definition of N and, by lemma 14.141 : 

XgXx{g){a)x \\-\/y{sy^N-^y^N). Hence the result. D 

From theorem I4.12( ii) , it follows immediately that the recurrence scheme of ZF is realized 
in A/" ; it is the scheme : 

yx(yy{F[x,y] -^ F[x,sy]), F[x,0] — )• (Vre G N)F[x, re]) for every formula F[x,y] of ZF (i.e. 
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written with ^, ^, 0, s). 

Then, indeed, the formula F is compatible with the extensional equivalence ~. 

Since the function s is compatible with ~, we deduce from lemma [4.141 that the formula : 

Vy(y € N — >• sy € N) is realized in M ; the formula € N is also obviously realized. 

From the recurrence scheme just proved, we deduce that : 

N is the set of integers of the model J\f , considered as a model of ZF. 

Theorem 4.16. 

i) Let / : N^ ^ N 6e a recursive function. Then, the formula : 
\/x^ . . . \/x^{f{xi, . . . , Xfc) eN) is realized in J\f . 
ii) Let g ■.'H^ ^ 2 be a recursive function. Then, the formula : 
Vx^ . . . Vx^((7(j;i, . . . , Xk) = 1 V g{xi, . . . , Xk) = 0) is realized in J\f. 

i) This can be written Vx^"^* . . . Vx|°* ent(/(xi, . . . , x^)). The proof is done in [181 [15]. 

ii) We have M \\- (yxielN) . . . (yxkelN) gixi, . . . ,Xk)e22. 

Now, since g is recursive, we have, by (i) : 

M \\- (Vxi e N) . . . (Vxfc e N) g{xi, . . . , x^) e N. 

Hence the result, by lemma [4. 171 □ 

Lemma 4.17. XxXyXf{f)xy ||-Vx-'^(x ^ l,x 7^ -)■ x^N). 

Proof. We have to show : 

AxAyA/(/)xy |hT,±^O^N and AxAyA/(/)/x2/ |h ±, T ^ l^N. 

Thus let C ||— T (i.e. ^ E A arbitrary) and r] ||— X. We have to show : 

XxXyXf{f)xy-k^.r].O.TT&A. and XxXyXf{f)xy-kr].^.l.TT£JL 

which is trivial. □ 



Remarks, i) In the present paper, theorem 14. 161 is used only in trivial particular cases. 

ii) Let us recall the difference between UN and N (the set of integers in the model A/") ; we have : 

C |hVx™i^[x] iff (Vn e N)(V7r e ||F[s"0]||)C*7r e X. 

C||-VxNF[x] iff (VneN)(V7re ||F[s"0]||)e^*n.7reX. 

Notice that we have K |^Va;(x^!lN -^ x^N), in other words JiT ||-N C JN. This means that, in 

Af, the set N of integers is strongly included in UN. In the particular realizability model considered 

below (and, in fact, in every non trivial realizability model), the formula 3N ^ N is realized. 

Non extensional and dependent choice. 

For each formula F{x, yi, . . . , ym) of ZF^, we add a function symbol fp of arity m + 1, with 

the axiom : yy{\/k^F[fp{k,y),y\ — >■ VxF[x,y]) 

or else : yy{^k''''^F[fF{k,y),y\ -^ VxF[x,yl). 

It is the axiom scheme of non extensional choice, in abbreviated form NEAC. 

Remarks, i) The axiom scheme NEAC does not imply the axiom of choice in ZF, because we do 

not suppose that the symbol fp is compatible with the extensional equivalence ~. It is the reason 

why we speak about non extensional axiom of choice. On the other hand, as we show below, it 

implies DC (the axiom of dependent choice). 

ii) It seems that we could take for fp a m-ary function symbol and use the following simpler (and 

logically equivalent) axiom scheme NEAC : My{F[fp{y),y\ — > \/xF[x,y\). 

But this axiom scheme cannot be realized, even though the axiom scheme NEAC is realized by a 
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very simple proof-like term (theorem 14. 18|) . provided the instruction <7 is present. 

More precisely, we can define a function fp in A4, such that NEAC is realized in TV, but this is 

impossible for NEAC 

Theorem 4.18 (NEAC). 

For each closed formula MxiyF, we can define a {m+l)-ary function symbol fp such that : 
Ax(?)xx |hVy(VA;e"*F[/i7(A;,y)/x,y] ^ VxF[x,yl). 

Proof For each A; e N we put Pj. = {ir eU; ^-k k.TT ^ ±, k = n^}. 

For each individual x, we have : ||VxF[x,yl|| = I J ||F[a,y]||. 

a 

Therefore, there exists a function fp such that, given /c € N and y such that 

Pfcn||VxF[x,y]||/0, we have P^ n ||F[/^(A:,y),y]|| / 0. 

Now, we want to show Ax(?)xx \\-yk'^^^F[fF{k,y),y\ — ?> F[x,y\, for every individuals x,y. 

Thus, let S^ \\-yk'^'^^F[fF{k,y),y\ and vr G ||F[a,y]|| ; we must show Ax(<;-)xx 7*r^ . vr € X. 

If this is false, we have ? * ^ . ^ . vr ^ X and therefore ^ * j . vr ^ X with j = n^. 

It follows that TT e Pj n \\F[a,y\\\ ; thus, there exists vr' e Pj n \\F[fFiJ,y),y\\\. 

Now, we have j . vr' G \\\/k F[fp{k,y),y\\\, and therefore, by hypothesis on S,, we have : 

^•k j .tt' G X. This is in contradiction with vr' G Pj . □ 

NEAC implies DC. Let us call DCS (dependent choice scheme) the following axiom scheme : 

yz{yx3yF[x, y, z\ ^Vn'^^^Bly Spin, y, z\ A Vn^^^By Vl^fln, y, z1, 5^[sn, y' , z\,F[y, y' , z\}). 

where P is a formula of ZF^ with free variables x,y,z ; the formula Sp is written below. 

In the following, we omit the variables z (the parameters), for sake of simplicity. 

The usual axiom of dependent choice DC is obtained by taking for F[x, y, zq, zi] the formula 

y£ZoA{xszo^- <x,y> e zi). 

We now show how to define the formula Sp, so that ZF^, NEAC h DCS ; we shall conclude 

that DC is realized. 

So, let us assume VxBy F[x,y]. By NEAC, there is a function symbol / such that : 

\/x3k^^^F[x, f{k,x)]. We define the formula Rp[x,y] as follows : 

Rf[x, y] = 3k^^^{F[x, f{k, x)],yi^^Hi <k^ -F[x, f{i, x)]), y = /(A;, x)}. 

This means : "y = f{k,x) for the first integer k such that F[x, f{k,x)] ". 

Therefore, Rp is functional, i.e. we have ^/xBly RF{x,y). 

Sp is defined so as to represent a sequence obtained by iteration of the function given by 

Rp, beginning (arbitrarily) at : 

Sp{n,x) = \/z[imyy\/y'{<m,y> e z, Rp{y,y') — )• <sm,y'> e z), <0, 0> e z ^- <n,x> e z\. 

It should be clear that, with this definition of Sp, we obtain : 

Vn^'itaiy^^fn,?/] and Vn^^^tByVISFin,?/], 5F[sn,y'],F[y,y']}. 

Thus, DCS is provable from ZF^ and NEAC. 

Remark. We have used the binary function symbol <a;, y> which is defined, in the ground model A^, 

in the usual way : <a, h> = {{a}, {a, &}}. Then, the formulas : 

Va;Va;'Vj/Vy'(<x,y> — <x',y'> ^^ x = x'), \fx\/x'yy\fy'(<x,y> = <x',y'> ^^ y — y'), 

are trivially realized by /. 
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Properties of the Boolean algebra 112. 

Let {x<y) be the binary recursive function defined as follows in Ai : 

{m<n) = 1 if m, n G N, m < n ; else (m<n) = 0. 

Theorem 4.19. For every choice of i, the relation {x<y) = 1 is, in J\f, a strict well 
founded partial order, which is the usual order on integers (i.e. on NJ. 

Proof. Indeed, the formulas : 

Vx((x<x) 7^ 1) and \/x\/yyz{{x<y) = 1 "^^ {{y<z) = 1 "^^^ {x<z) = 1)) 

are trivially realized. 

Moreover, since the relation {x<y) = 1 is well founded, we have (theorem I4.9p : 

Y |hVx(Vy((y<x) = 1 ^ F[y]) -^ F[x]) ^ VxF[3;] 

for every formula F[x\ with parameters and one free variable. 

By theorem I4.16( ii). the binary recursive function {x<y) sends N^ into {0,1}, in the 
model J\f. Therefore, it suffices to check that the following formulas are realized in J\f : 

Va;^v/(y <x^ {x<y) ^ 1) ; Vx^v/(x <y^ {x<y) = 1). 
Now the following formulas are trivially realized : 

V2;^^Vy^^Vz™(x = y + z^ {x<y) ^ 1) ; Vx^^Vy^^Vz™(2/ = x + z + l^ {x<y) = 1). D 

In the ground model M., we put, for each integer n : 

n = {0, 1, . . . , n - 1} = {0, sO, . . . , s'^-^O}. 
The functions n i — > n and n i — > Jn are defined in the realizability model A^, with do- 
main UN. 

Theorem 4.20. 

The following formulas are realized in J\f : 
i) Vx Vm ((x<m) = 1 <-^ xe1\a) ; 
ii) Vm-'^Vn-'^((m<n) = 1 -> Hm C Hn) ; 
iii) Vx^^Vm^^((x<m) = 1 o 3y^^{m = x + y + l)). 

Proof. Remember that x C y is the formula \lz{z^y -^ z^x). 

i) We have trivially || (a<m) ^ 1|| = ||a^IIm|| for every a, m E N. 

ii) By transitivity of the relation {m<n) = 1 (theorem 14. 19|) . 
iii) We observe that ||(a<?TT,) 7^ 1|| = ||(Vy e UN) (rri ^ a + y + \)\\ for every a,m ^'H. D 

For each nellN (and, in particular, for each neN, i.e. for each integer of AA), the set defined, 
in N , by {x<n) = 1 (the strict initial segment defined by n) is therefore extensionally 
equivalent to ZIn. 

Theorem 4.21. In N , the application {x,y) 1 — > my + x is a bijection from Hmxlln onto 
Il(mn). Indeed, the following formulas are realized in M by I : 
i) V?7i Vn Vx Vy ((rn-y-l-x)ellmn) ; 

ii) Vm^^Vn^^Vx^'"Vx'^'"Vy^"Vy'^"(my + x = my' + x' ^ x = x') ; 
Vm^^Vn^^Vx^'"Vx'^™Vy^"Vy'^"(my + x = my' + x' ^ y = y') ; 
iii) Vm^NVn^^Vz^'""3x^'"3y^"(z = my + x). 

Proof. 

i) and ii) We simply have to replace Mm? and Vx with their definitions, which are : 
Mm^^F = Mm{ln{m) = 1 -^ F) ; Vx^'^F = Vx((x<m) = 1 -^ F). 
We see immediately that these two formulas are realized by /. 
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iii) We show that : 

/ Ih Vm™Vn™Vz^^(Vx^f^Vy^'^((a;<m) = 1 -^ ((y<n) = 1 ^ z ^ my + x)) ^ {z<mn) / 1). 

Thus, we consider : 

m,n,zo€'N; ^ G A, ^ ||- Vx-'^Vy-'^((x<m) = 1 M- {{y<n) = 1 ■-^> z / my + x)) 

and vr G ||(zo<W''^) 7^ 1||- We must show /•.^.vr S i, that is ^*7r G X. 

We have \\{zQ<mn) 7^ 1|| 7^ 0, therefore zq < ran. 

Thus, there exist xq, yo £ N, xq < m,yo < n such that zq = "^^jq + yo- 

Now, by hypothesis on ^, we have : 

C \\- {xQ<m) = 1 M- ((2/o<^) = 1 "^^ -20 7^ w-yo + 2;o)) in other words ^ ||— _L. D 

Injection of 2n into 'P(N). Remember that we have fixed a recursive bijection : ^ 1 — > n^ 

from A onto N. The inverse bijection will be denoted n 1 — > ^n- 

This bijection is used in the execution rule of the instruction c;, which is as follows : 

We define, in M, a function A : N ^ 2 by putting A(n) = ■^ ^^ Ih -•-• 
In this way, we have defined a function symbol A, in the language of ZF^. In the realizability 
model M, the symbol A represents a function from UN into 112. In particular, the function 
A sends the set N of integers of the model Af into the Boolean algebra 112. 

Theorem 4.22. Let us put 9 = \x\y[q)yxx ; then, we have : 

6 \r^x^^{x / ^ 3n^'^*{A(n) / 0, A(n) < x}) 
where < is the order relation of the Boolean algebra 22 : y < x is the formula x = (yvx). 

Proof We must show 9 |^ Vx^^(x / 0, Vn'''^^(A(n) / ^ x / A(n)vx) -^ ±). 

Thus, let a €{0,1}, ^\\-a^0, ?? |h Vn^'^^(A(n) / ^ a / A(n)va) and vr G H. 

We must show 9 -k^ .r] .tt G i that is <j * r/ . ^ . ^ . vr G i, or else 7/ * ru . ,^ . vr G X. 

By hypothesis on r/, it suffices to show He . .^ . vr G ||Vn*''^*(A(n) 7^ — )• a 7^ A(n)va)||, that 

is, by definition of the quantifier Vn®"^^ : ^ . vr G ||A(ng) 7^ — ?• a 7^ A(ng)va||. 

This amounts to show ^ ||— A(ng) 7^ and a = A(ng)va. 

• Proof of S. \\- A(ng) / : if A(n^) = 1, this is trivial, because ||A(n5) / 0|| = ; 
if A(n^) = 0, then ^ ||- ±, by definition of A. 

• Proof of a = A(n^)va : this is obvious if a = 1 ; if a = 0, then ^ ||— X, by hypothesis 
on ^. Therefore A(ng) = by definition of A, hence the result. □ 

By theorem 14.221 the set {A(n); neN, A(n) 7^ 0} is, in the realizability model Af, a count- 
able dense subset of the Boolean algebra 112 : this means that each element 7^ of this 
Boolean algebra has a lower bound of the form A(n), with neN and A(n) 7^ 0. 
It follows that the application of 22 into V{N) given by : 

XI — ^ {neN; A(n) < x, A(n) 7^ 0} 
is one to one : indeed, if a, be 22 with a ^ b, then a + b ^ ; thus, there exists an 
integer neN such that A(n) 7^ and A(n) < a + b. Therefore, we have A(n) < a iff 
(6AA(n)) = 0. 

But, since A(n) 7^ 0, we get : A(n) < a iff A(n) ^ b. 
We have shown : 

Theorem 4.23. 

The formula : ''there exists an injection of 22 into ^(N)" is realized in the model M . □ 
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Corollary 4.24. The formula : "for every integer n there exists an injection of Hn into 
■p(N) " is realized in the model J\f. 

Proof. Using theorem 14.211 we see, by recurrence on m, that the model J\f realizes the 

formula : 

" V?7i^((!l2)"^ is equipotent to !l(2™)) " ; and therefore also the formula : 

" Vm^ (there exists an injection of ^(2"") into P(N)) ". 

Finally, by theorem 14.20( 11) , we see that the following formula is realized : 

" Vn^(there exists an injection of Hn into 7^(N)) ". □ 

5. Realizability models in which M is not well ordered 

!]2 atomless. 

Theorem 5.1. We suppose there exist two proof-like terms ujo,uji such that, for every 
TT (z II, we have uj^kj^ \\~ -^ or ujikj^ Ih-L- Then, the Boolean algebra 22 is non trivial. 
Indeed : 6 \\-yx{x ^ l,x / ^ x^22) -^ _L with 9 = \f{cc)Xk{{f){ui)k){ujo)k. 

Proof. Let S, ||— Va;(x 7^ l,x ^ ^- x^22) and vr € H. We must show : 

6 -kS, . IT (z -L, that is ^ * i^ik,r • ^o^tt • vr G X. 

But, by hypothesis on ^, we have S, [^ T, ± ^ ± and ^ |^ ±, T ^ ±. Hence the result, 

by hypothesis on uji,ujq. □ 

Remark. When the Boolean algebra 22 is non trivial, there are necessarily non standard integers 
in the realizability model M, i.e. integers which are not in A4. Indeed, let ae22,a 7^ 0, 1 ; by 
theorem 14. 22i there is an integer n such that A(n) j^ 0, A(n) < a ; thus A(n) ^ 1. The integer n 
cannot be standard, since A(?ti) = or 1 if tti is in A^. 

Theorem 5.2. We suppose that there exists three proof-like terms ao, 01,02 such that, 
for every ^ € A and it £ll, we have /c^^ao Ih -L or /c,r^ai Ih -L or kT^^a2 \\- -L. 
Then, the Boolean algebra 22 is atomless. Indeed : 

9 \\-\fx[\/y{xAy ^0,XAy y^ x -^ y^22),x /0^x^:]2] 
with 9 = XxXy{cc)Xk{{x){k)yao){{x){k)yai){k)ya2. 

Proof. By a simple computation, we see that we must show : 
[)9 \^{±,±^±),±^±. 
ii) 9 |h|T,_L^_L|n|_L,T^_L|,T^_L. 

Proof of (i) : let r/ S |_L, ± ^ ±j and ^ € |-L|. We must show * r/ . ^ • vr E X, that is : 
r] ■kKS.ao . {{r]){K)S,ai){K)(a2 ' n G X. 
But, from ^ ||- X, we deduce k^r^C Ih -L ^^ every C G Ac. 
Since r/||— X,X— >X, we have ((r/)(k^)^ai)(k^)^a2 ||- X and therefore : 
r?*k^^ao.((r/)(k^)^ai)(k^)^Q2.7r € X. 

Proof of (ii) : let r? G |T, X — > X| PI |X, T — )• X| and S, G Ac. Again, we must show that : 

ry*k,r'?ao • {i''l){^n)^cti){\^Tr)^ct2 . vr G X. If this is false, then : 

^TT^ceo Ih -L (because t] ||- X, T — > ±) and 

{{v){K)Cai){K)Ca2 IfX (because r]\\-T,±^ X). 

But, since rj ||— X, T ^ X (resp. T, X ^ X), we have kT^^ai |h X (resp. k7r^a2 |h ^)- 

This contradicts the hypothesis of the theorem. □ 
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M not well orderable. 

Theorem 5.3. 

We suppose that there exists a proof-like term oj such that, for every ^, ^' € A, ^ 7^ ^' and 

vr E n, we have ujkj^^ \\~ -^ or cokj^S^' \\- -L. 

Then we have, for every formula F with three free variables : 

9 |hVm™Vn™Vz[(m<n) = 1 ^ 

(VxV2/Vy'(F(x, y, z),F{x, y' , z),y^y'^ ±), Vy^"-Vx^-- F(x, y, z) ^ ±)] 
with 9 = XxXx'{cc)Xk{x')Xz(xzz){u})kz. 

Remark. This shows that, if {m<n) — 1, then (Hm C In and) there is no surjection of Hm onto Hn : 
indeed, it suffices to take, for F{x,y,z), the formula <x,y> e z. 

Proof. Assume this is false ; then, there exist m, n G N with m < n, an individual c, two 
terms ^,^' € A and a stack vr G 11 such that : 

9*^.C -TT ^ ±; 

^ \\-yxyyyy'[F{x,y,c),F{x,y',c),y / y' ^ ±] ; 

Therefore, we have ^' -kr].TT ^ X with 77 = Xz{^zz){uj)Wt^z. By hypothesis on ^' we 

have, for every integer i < n : r] \\^ Vx -iF(x, i, c). Thus, there exists an integer rui < m 

such that rj ^ ^F{mi,i,c). It follows that there exist ^j € A and ttj G 11 such that 

^i \\- F{mi,i, c) and r] -k ^i .ni ^ i. By definition of r], we get C *?«•?« • ^^-K^i . ttj ^ X. 

By hypothesis on ^, it follows that ujkT^^i \^ i ^ i ; in other words, we have wk^r^j \f- X 

for every integer i < n. 

By the hypothesis of the theorem, it follows that we have ^j = ^j for every i,j < n. 

But, since mi < m < n and i < n, there exist i,j < n, i ^ j such that ttij = mj = k. 

Then, ^j = ^j \\- F{k,i,c), F{k, j,c) and ujk^r^i \\- i ^ j since \\i ^ j\\ = 0. 

Therefore, by hypothesis on ^, we have ^*^j . S,i • wk^r^j • vtj G X, which is a contradiction. □ 

Now, we see that, with the hypothesis of theorem 15.31 there is no surjection from 112 onto 
112 X 112. Indeed, by theorem 14.211 there exists a bijection from 22 x 112 onto 114 and, by 
theorem 15.31 there is no surjection from 112 onto 114. But, by theorem 15.21 112 is infinite ; it 
follows that 112 cannot be well ordered. _ 

Now, by theorem 14.231 112 is equipotent with a subset of 7^(N). Therefore, the hypothesis 
of theorems 15.21 and 15.31 are sufficient in order that the following formula be realized in the 
model M : 

There is no well ordering on the set of reals. 
In fact, the hypothesis of theorem 15.31 is sufficient : this follows from theorem 15. 4[ 

Theorem 5.4. Same hypothesis as theorem \5.3\ : there exists a proof-like term, oj such that, 
for every tt G 11 and ^, ^' G A, ^ 7^ ^' , we have ojk-,^^ ||— X or ujk^^^' ||— X. 
Then we have, for every formula F with three free variables : 

9 |hVz{Vx[Vn«'"*F(n,x,z) ^ x^:i2], VnVxVyhF(n,x, z)^F(n,?/, z),x / y ^ X] ^ X} 
with 9 = XxXx'{cc)Xk{x)Xn{cc)Xh{x'hh){u)k)Xf{f)hn. 

Remark. This formula means that, in the realizability model A/", there is no surjection from the 
set of integers N onto 12 : it suffices to take for F{x, y, z) the formula <x, y> f. z (the graph of an 
hypothetical surjection being <x, y> e z). 
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Proof. Reasoning by contradiction, we suppose that there is an individual c, a stack vr G H, 

and two terms (,, (,' such that : 

^ \\-\/x[\/n^^^ F{n,x,c) ^ x^']i2] ; ,^' ||— VnVxVy[-iF(n, 2;,c)-iF(n, y, c),x ^ y — t- ±] and 

(9 * ^ . C' . vr ^ X. 

Therefore, we have ^*?y . vr ^ X, with rj = An(cc)A/i(^'/i/i)(ct;k^)A/(/)/in. 

By hypothesis on ^, we have ry |}^ Vn®"^* -F(n, 0, c) and ry ||^ Vn'^'^* F(n, 1, c). Thus, we 

see that there exist nQ,ni € N, ttq G ||F(no,0, c)|| and vri € ||F(ni, l,c)|| such that 

rj-kriQ .ttq ^ X and r/ • n^ . vri ^ X. By performing these two processes, we obtain : 

^' -k K^ . k^o . Co . TTo ^ X et C' • K^ . K^ . Ci . vTi ^ X, 

with Co = (wk^)A/(/)k^ono and Ci = i^K)>^fif)Kim- 

By hypothesis on C', we have C' Ih ^F^nQ, 0, c), -iF(no, 0, c), / — )■ X. 

Since kjrg ||— -iF(no,0, c), we see that Co IF -L and, in the same way, Ci 11^ -L- 

Thus, by the hypothesis of the theorem, we have : 

-^/(/)'^7roIio = '^/(/)'^TiIli5 and therefore no = rai and ttq = tti. 

But, we have ^' ||- -iF(no, 0, c), -'F(no, 1, c), 7^ 1 — > X. Moreover, we have : 

TTo € ||-F(no, 0,c)|| and vri € ||F(ni, 1, c)||, thus ttq G ||F(no, 1, c)|| since uq = rii, ttq = tti. 

Therefore k^ro ||— -'F(no,0, c) and -iF(no, l,c). Moreover, we have obviously Co IKOt^Ij 

since ||0 / 1|| = 0. Therefore, we have ^'*k^„ • k^„ . Co • ttq G X, which is a contradiction. D 

Theorems 15.31 and 15.41 show that ZI2 is infinite and not equipotent with Il2xII2, thus not well 
orderable. Since 112 is equipotent with a subset of P(N) (theorem 14. 23p . we have shown that 
7^(N) is not well orderable, with the hypothesis of theorem 15.31 

More precisely, by corollary 14.241 we know that Hn is equipotent with a subset of V(N) for 
each integer n. Therefore, we have : 

Theorem 5.5. With the hypothesis of theorem \5.3\ the following formula is realized : 
" There exists a sequence X^ of infinite subsets of 'P(N) such that, for every integers 
m,n >2 : 

• there is an injection from Xn into Xn+i ; 

• there is no surjection from Xn onto Xn+i ; 

• Xm X Xn and Xmn Oi^c cquipotent ". □ 

For each integer n > 2, the set n = {0, 1, . . . , n— 1} is a ring : the ring of integers modulo n ; 
the Boolean algebra {0, 1} is a set of idempotents in this ring. These ring operations extend 
to the realizability model, giving a ring structure on Hn, and 22 is a set of idempotents 
in 2n. 

For each a 822, the equation ax = x defines an ideal in 2n, which we denote as a2n. 
The application x 1 — > ax is a retraction from 2n onto a2n. 

Proposition 5.6. The following formulas are realized in J\f : 
i) Vn-'^Va-'^(i/ie application x 1 — > {ax, (1 — a)x) is a bijection 

from ZIn onto a2n x (1 — a)2n). 
ii) \/m \/n ya {the application {x,y) 1 — > my + x is a bijection 

from a2mxa2n onto a2{nin)). 

Proof. 

i) Trivial : the inverse is {y, y') 1 — > y + y' . 

ii) By theorem 14. 21^ this application is injective ; clearly, it sends a2nixa2n into all(mn). 
Conversely, if zea2{mn), then there exists xeUm and ye2n such that z = my + x ; 
thus, we have z = az = may + ax with axeaUm and ayeaHn. □ 



REALIZABILITY ALGEBRAS II : NEW MODELS OF ZF + DC 25 



Theorem 5.7. We suppose that, for each q € A, vr £ 11, and every distinct Co;Ci)C2 ^ A, 

we have /CttoCo lh ^ '''" k^^Oid \\- _L or kT^aC,2 Ih -L- 

Then, for each formula F[x, y, z) with three free variables, we have : 

e |hVzVm™Vn^^Va^2[(2m<n) = 1 ^ 

(a / 0,VxVyVy'(F(x,y,z),F(x,y',z),y / y' ^ ±), Vy^"3x^-F(x,a2/, z) ^ ±)] 
with 9 = \a\x\y{cc)\k{y)\z{xzz){k)az. 

Remark. This formula means that, if n > 2m, ae32,a ^ 0, then there is no surjection from 3m 
onto ain : it suffices to take F{x, y, z) = <x, y> e z. 

Proof. Reasoning by contradiction, let us consider ?n,, n G N with n > 2m, a G {0, 1}, an 

individual c, three terms a,S,,r] E A and vr G 11 such that : 

e*a.^.r].TT^±, a|ha/0, ^ Ih VxVyVy'(F(x,y,c), F(x,y', c),y / y' ^ ±), 

rj jj— Vy -iVx -i-F(x,ay,c). 

We have 9 -k a .^ .rj . tt >- r]-k6' .tt and therefore rj-kO' .tt ^ X with 9' = \z{^zz){WTj)az. 

It follows that, for every y € {0, . . . , n — 1}, we have 9' \y- \/x^™-^F{x, ay, c). 

Thus, there exist two functions y i — > Xy (resp. y i — > Cy) from {0, ... ,n — 1} into 

{0, . . . , m — 1} (resp. into A), such that Cy Ih -^(^^y > ^2/) c) and 9' -kC.y . zuy ^ X (for some 

suitable stacks zUy). 

Now, we have 9' -k Qy . Wy y S,-kCy • Cy ' I'^y ' '^y with Ky = kj^a^y ; therefore, we have : 

? * Cy • Cj/ • ^j/ • ^j/ ^ -IL for each y G {0, . . . , n — 1}. 

By hypothesis on ^ (with y = y'), it follows that Ky |h X for every y < n. 

It follows first that a |h ^ and therefore, we have a = 1 ; thus (y \\- F{xy,y,c). 

Moreover, since n > 2m, there exist yo,yi,y2 < n distinct, such that XyQ = Xy^ = Xy^. 

But, following the hypothesis of the theorem, the terms Cj/o > Cyi > Cs/2 cannot be distinct, 

because Hyo , ''^yn f^y2 Ih-L- Therefore we have, for instance, Cj/o — Cyi ; then, we apply the 

hypothesis on ^ with y = yo,y' = yi, which gives ^ * Cj/o • Cyi • '^ • ^ ^ -"- fo^^ every k G A 

and ti7 G n. But it follows that ■^ * Cj/o • Cj/o • ^yo • ^yo ^ -"- which is a contradiction. □ 

Corollary 5.8. With the hypothesis of theorem \5.7[ the following formulas are realized : 
i) \/n ^a {a 7^ — > there is no surjection from Hn onto a2{n + 1)). 
ii) Vn Va V6 (aA6 = 0,6 7^ — > there is no surjection from a2n onto b'22). 

iii) Vn^Va V?r'^(aA6 = a,a ^ b -^ there is no surjection from ain onto b22). 

Proof. 

i) Suppose that there is a surjection from 2n onto a2{n + 1). Then, by the recurrence 
scheme (theorem 14. 12l fii)). we see that, for each integer A; G N, there exists a surjection from 
(In)^ onto {a2{n + 1))^ ; and, by proposition 15. 6l fii) and the recurrence scheme, it follows 
that there is a surjection from Il(n^) onto all((n + 1)''). 
But, for k > n, we have (n + l)'^ > 2n^ and this contradicts theorem 15.71 
ii) Since oa^ = 0, the rings (a + b)2n and a2n x b2n are isomorphic. Reasoning by con- 
tradiction, there would exist a surjection from (a + b)2n onto b22 x b2n, thus also onto 
b2{2n) (proposition 15. 6r ii)). thus a surjection from Hn onto b2{2n), which contradicts (i). 
iii) Otherwise, there would exist a surjection from a2n onto {b — a)22, which contradicts (ii). 

D 

Applications. 

i) By DC, since 112 is atomless, there exists in 112 a strictly decreasing sequence. Hence, by 
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corollary I5.8( iii) and theorem 14.231 there exists a sequence of infinite subsets of 'P(N), the 
"cardinals" of which are strictly decreasing. 

ii) Applying corollary I5.8l fii) with n = 2, we see that there exist two subsets of V(N) the 
"cardinals" of which are incomparable ; which means that there is no surjection of one of 
them onto the other. 

More precisely, let B be the image of 112 by the injection in V{N) given by theorem 14.231 ; 
then we have : 

Theorem 5.9. With the hypothesis of theorem \5.7\ the following formula is realized in Af : 
"There exists a subset B of'P(N) (the real line of the model Af), such that 
B is an atomless Boolean algebra for the usual order C on 'P(N), with 0,N E B ; 
a,b e B^ aCib e B. 

If a (z B,a^ (Ji then aB is infinite and there is no surjection from B onto aBxaB 
(where aB means {x G B; x Q a}). 

If a,b & B,a,b ^ ^ and a n 6 = 0, then there is no surjection from aB onto bB (the 
"cardinals" of aB,bB are incomparable). 

If a,b € B,a (^b and a ^ b, then there is no surjection from aB onto bB (the "cardinal" of 
aB is strictly less than the "cardinal" of bB)". □ 

In other words, for a,b € B, we have : a C 6 <^ there exists a surjection from bB onto aB. 
The order, in the atomless Boolean algebra B, is the order on the "cardinals" of its initial 
segments. 

The model of threads. This model is the canonical instance of a non trivial coherent 

realizability model. It is defined as follows : 

Let n I — > Tin be an enumeration of the stack constants and let n i — > 9n be a recursive 

enumeration of the proof-like terms. For each n € N, the thread with number n is the set of 

processes which appear during the execution of the process 6^* tTu- In other words, it is 

the set of all processes ^ * vr such that 0„ * 7r„ ;^ ^ * vr. 

Note that every term which appears in the n-th thread contains the only stack constant vr^. 

We define A.^ (the complement of X) as the union of all threads. Thus, a process ^ * vr is 

in i'' iff (3n G N) 6'n * 7r„ ^ ^ * vr. 

Therefore, we have .^ • vr G X iff the process ^ * vr never appears in any thread. 

For every term ^, we have ^ ||— _L iff ^ never appears in head position in any thread. 

If ^ is a proof-like term, we have £, = On for some integer n, and therefore .^ * 7r„ ^ i, by 

definition of X. It follows that the model of threads is coherent. 

If ^ € A, ^ 11^ ± then ^ appears in head position in at least one thread. This thread is 

unique, unless ^ is a proof-like term, because it is determined by the number of any stack 

constant which appears in ^. 

Theorem 5.10. The hypothesis of theorems \5.1[ \5.SX 15.31 and 5.1 are satisfied in the model 
of threads. 

Proof. The hypothesis of theorems 15.31 and 15.11 are trivially satisfied if we take : 
(jj = {Xx xx)Xxxx, ujQ = {uj)0, and ui = (u;)l. 

Moreover, the hypothesis of theorem 15.71 is obviously stronger than the hypothesis of theo- 
rem [521 
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We check the hypothesis of theorem 15.71 by contradiction : 

Suppose that kT^aCo If- -L, kyroCi IF -L ^.nd k,raC2 11^ -L- Therefore, these three terms appear 

in head position, and moreover in the same thread : indeed, since they contain the stack vr, 

this thread has the same number as the stack constant of vr. 

Let us consider their first appearance in head position, for instance with the order 0, 1, 2. 

Therefore we have, in this thread : kj^aCo ■kpQ>-a-k'K>~--->- W-,^aC,i * Pi >- a • vr >- • • • 

But, at the second appearance of a *7r, the thread enters into a loop, and the term ^.,^0^2 

can never arrive in head position, since Ci 7^ C2- D 
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